diff --git a/oslo_versionedobjects/fixture.py b/oslo_versionedobjects/fixture.py
index b431950e..545f681d 100644
--- a/oslo_versionedobjects/fixture.py
+++ b/oslo_versionedobjects/fixture.py
@@ -369,12 +369,13 @@ class ObjectVersionChecker(object):
             for my_version, child_version in versions:
                 _my_version = vutils.convert_version_to_tuple(my_version)
                 _ch_version = vutils.convert_version_to_tuple(child_version)
-                assert (last_my_version < _my_version
-                        and last_child_version <= _ch_version), \
-                    ('Object %s relationship '
-                     '%s->%s for field %s is out of order') % (
-                         obj_class.obj_name(), my_version,
-                         child_version, field)
+                if not (last_my_version < _my_version
+                        and last_child_version <= _ch_version):
+                    raise AssertionError(('Object %s relationship %s->%s for '
+                                          'field %s is out of order') % (
+                                              obj_class.obj_name(),
+                                              my_version, child_version,
+                                              field))
                 last_my_version = _my_version
                 last_child_version = _ch_version
 
diff --git a/test-requirements.txt b/test-requirements.txt
index 70bc6c94..0f9e355c 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -9,3 +9,6 @@ jsonschema<3.0.0,>=2.6.0 # MIT
 
 mock>=2.0.0 # BSD
 fixtures>=3.0.0 # Apache-2.0/BSD
+
+# Bandit security code scanner
+bandit>=1.1.0 # Apache-2.0
diff --git a/tox.ini b/tox.ini
index cb12dee2..930cacfd 100644
--- a/tox.ini
+++ b/tox.ini
@@ -13,7 +13,12 @@ deps =
 commands = python setup.py testr --slowest --testr-args='{posargs}'
 
 [testenv:pep8]
-commands = flake8
+deps =
+  -r{toxinidir}/test-requirements.txt
+commands =
+  flake8
+  # Run security linter
+  bandit -r oslo_versionedobjects tests -n5 --skip B303
 
 [testenv:venv]
 commands = {posargs}